Legal

Privacy policy

Last updated 2026-09-01. Controller for this website: Soor LLC, 16192 Coastal Hwy, Lewes, DE 19958, USA.

Diagram titled "Privacy practice", showing the seven RFQ-to-order stages from enquiry intake through to accepted order.

In short

Soor LLC operates KanchanFlow, an RFQ-to-Order CRM, from Delaware, USA. This policy explains what personal data we collect on our website and in the product, why we hold it, who else processes it, how long we keep it and how to exercise your rights under CCPA and GDPR.

This is our published policy. It is not legal advice, and it does not replace a signed agreement — for a negotiated MSA or DPA, contact [email protected].

In plain English

We collect what you give us — your name, work email, company and anything you type into a form — plus basic analytics about how the website is used. Inside the product, the customer data you load is yours; we are only the processor. We do not sell anything, we do not train AI on your records, and everything sits in USA data centers. You can ask us what we hold, correct it, or have it deleted.

1. Who we are

Soor LLC, 16192 Coastal Hwy, Lewes, DE 19958, USA, is the controller for personal data collected on kanchanflow.com and for the account data of our own customers. For the business records our customers load into their workspaces, our customer is the controller and we are the processor — the terms of that relationship are in the data processing addendum. Privacy contact: [email protected].

2. What we collect and why

Information you give us. Your name, work email, company name, shop type, phone number where you provide it, and the content of any message you send through a demo, contact, trial or free-tool form. We use it to answer you, to schedule a call, to create your workspace and to send the file you asked for. The legal basis is performance of a contract, or our legitimate interest in responding to a business enquiry.

Information from using the product. Authentication events, IP address, device and browser, and an audit trail of significant actions such as quote revisions, price overrides and exports. We use this to run the service securely and to investigate incidents. The legal basis is our legitimate interest in operating a secure system.

Files you submit to the free RFQ Analyzer. Processed to produce your output, then deleted. Not retained as a dataset and never used for training.

Website analytics. Aggregate usage measurement through Google Analytics 4 and Microsoft Clarity, described in the cookie policy with an opt-out.

Billing information. Handled by our payment processors. We see the last four digits, the card brand and the billing address; we never store a full card number.

3. What we never do

We do not sell or share personal information as those terms are defined by the CCPA. We do not use your RFQs, drawings, quotes, prices or customer records to train any machine-learning model, ours or a vendor's. We do not enrich your record from data-broker sources. We do not place advertising cookies on this website.

4. Who else processes it

We use a small set of sub-processors — hosting, WhatsApp delivery, payment processing, document OCR and transactional email. Each is named, with its purpose and its region, in the Trust Center. We give customers notice before adding a new one.

5. How long we keep it

Data	Retention
Website enquiry and demo requests	24 months from last contact
Trial workspaces that do not convert	Deleted 30 days after the trial ends
Customer workspace data	For the life of the subscription, then 30 days
Backups	30 days, then aged out on the normal cycle
Security and audit logs	12 months
Files submitted to the RFQ Analyzer	Deleted after processing
Billing records	As long as tax and accounting law requires

6. Where it is held

In the USA at every tier — AWS US-East (N. Virginia) and US-West (Oregon) — with no offshore replication. EU or India residency is available on Enterprise by contract. Transfers of personal data out of the EEA or UK, where they occur, rely on the European Commission's standard contractual clauses, as set out in the DPA.

7. Your rights

Depending on where you live, you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to processing based on legitimate interest, or ask for it in a portable format. Under the CCPA you also have the right to know what categories we collect and to be free from discrimination for exercising a right. Write to [email protected]. We respond within 30 days, or 45 where the law allows an extension and we will tell you why. You can also complain to your supervisory authority; we would rather you told us first.

8. Security

TLS in transit, AES-256 at rest, role-based access control, audit logging, least-privilege production access and encrypted daily backups with point-in-time recovery. Our security practice, including RTO and RPO targets and responsible disclosure, is written out in the Trust Center. Report a vulnerability to [email protected].

9. Children

KanchanFlow is business software. It is not directed at children, and we do not knowingly collect personal data from anyone under 16.

10. Changes and contact

Material changes to this policy are notified by email to account owners at least 30 days before they take effect, and the last-updated date above changes on every revision. Questions, requests or complaints: [email protected], or Soor LLC, 16192 Coastal Hwy, Lewes, DE 19958, USA, telephone +1-607-318-2126. This policy is governed by the laws of the State of Delaware, USA.

Privacy questions

No. We do not sell or share personal information as those terms are defined under the CCPA, and we have never done so. There is no data-broker relationship behind this product.

Read the Trust Center next

Sub-processors, security practice, residency by tier and our quarterly audit of our own feature claims.

Start Free Trial (No Credit Card)See a Live Quote Draft

Delaware LLC
SOC 2 Type II
USA Data Centers (AWS)